datadog 2.7.1 → 2.17.0

data/lib/datadog/appsec/assets/waf_rules/strict.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.13.1"
+    "rules_version": "1.13.3"
   },
   "rules": [
     {
@@ -10,7 +10,8 @@
       "tags": {
         "type": "security_scanner",
         "crs_id": "913100",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -84,7 +85,8 @@
       "tags": {
         "type": "http_protocol_violation",
         "crs_id": "921120",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -127,7 +129,8 @@
         "crs_id": "921140",
         "category": "attack_attempt",
         "capec": "1000/210/272/220/273",
-        "cwe": "113"
+        "cwe": "113",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -154,7 +157,8 @@
       "tags": {
         "type": "command_injection",
         "crs_id": "932100",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -193,7 +197,8 @@
       "tags": {
         "type": "command_injection",
         "crs_id": "932115",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -690,7 +695,8 @@
       "tags": {
         "type": "command_injection",
         "crs_id": "932130",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -729,7 +735,8 @@
       "tags": {
         "type": "command_injection",
         "crs_id": "932150",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -768,7 +775,8 @@
       "tags": {
         "type": "php_code_injection",
         "crs_id": "933110",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -818,7 +826,8 @@
       "tags": {
         "type": "php_code_injection",
         "crs_id": "933180",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -857,7 +866,8 @@
       "tags": {
         "type": "php_code_injection",
         "crs_id": "933210",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -897,7 +907,8 @@
         "type": "xss",
         "crs_id": "941100",
         "category": "attack_attempt",
-        "cwe": "79"
+        "cwe": "79",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -948,7 +959,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941130",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -994,7 +1006,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941150",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1041,7 +1054,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941160",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1093,7 +1107,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941190",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1134,7 +1149,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941250",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1175,7 +1191,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941260",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1216,7 +1233,8 @@
       "tags": {
         "type": "xss",
         "crs_id": "941370",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1255,7 +1273,8 @@
       "tags": {
         "type": "js_code_injection",
         "crs_id": "941380",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1294,7 +1313,8 @@
       "tags": {
         "type": "sql_injection",
         "crs_id": "942151",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1333,7 +1353,8 @@
       "tags": {
         "type": "sql_injection",
         "crs_id": "942170",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1372,7 +1393,8 @@
         "type": "sql_injection",
         "crs_id": "942190",
         "category": "attack_attempt",
-        "cwe": "89"
+        "cwe": "89",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1413,7 +1435,8 @@
       "tags": {
         "type": "sql_injection",
         "crs_id": "942230",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1452,7 +1475,8 @@
       "tags": {
         "type": "sql_injection",
         "crs_id": "942320",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1490,7 +1514,8 @@
       "tags": {
         "type": "sql_injection",
         "crs_id": "942350",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1528,7 +1553,8 @@
       "tags": {
         "type": "java_code_injection",
         "crs_id": "944240",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1573,7 +1599,8 @@
         "type": "lfi",
         "category": "attack_attempt",
         "cwe": "22",
-        "capec": "1000/255/153/126"
+        "capec": "1000/255/153/126",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1612,7 +1639,8 @@
         "type": "lfi",
         "category": "attack_attempt",
         "cwe": "22",
-        "capec": "1000/255/153/126"
+        "capec": "1000/255/153/126",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1653,7 +1681,8 @@
       "tags": {
         "type": "nosql_injection",
         "category": "attack_attempt",
-        "cwe": "943"
+        "cwe": "943",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -1689,7 +1718,8 @@
       "name": "Node.js: Prototype pollution",
       "tags": {
         "type": "js_code_injection",
-        "category": "attack_attempt"
+        "category": "attack_attempt",
+        "module": "waf"
       },
       "conditions": [
         {
@@ -3060,4 +3090,4 @@
       }
     }
   ]
-}
+}

data/lib/datadog/appsec/autoload.rb

@@ -4,7 +4,7 @@ if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
   begin
     require_relative 'contrib/auto_instrument'
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
-  rescue StandardError => e
+  rescue => e
     Kernel.warn(
       '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
       " #{e.class.name} #{e.message}"

data/lib/datadog/appsec/component.rb

@@ -3,7 +3,7 @@
 require_relative 'processor'
 require_relative 'processor/rule_merger'
 require_relative 'processor/rule_loader'
-require_relative 'processor/actions'
+require_relative 'actions_handler'
 
 module Datadog
   module AppSec
@@ -12,7 +12,25 @@ module Datadog
       class << self
         def build_appsec_component(settings, telemetry:)
           return if !settings.respond_to?(:appsec) || !settings.appsec.enabled
-          return if incompatible_ffi_version?
+
+          ffi_version = Gem.loaded_specs['ffi']&.version
+          unless ffi_version
+            Datadog.logger.warn('FFI gem is not loaded, AppSec will be disabled.')
+            telemetry.error('AppSec: Component not loaded, due to missing FFI gem')
+
+            return
+          end
+
+          if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') && ffi_version < Gem::Version.new('1.16.0')
+            Datadog.logger.warn(
+              'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
+              'and will be forcibly disabled due to a memory leak in `ffi`. ' \
+              'Please upgrade your `ffi` version to 1.16.0 or higher.'
+            )
+            telemetry.error('AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0')
+
+            return
+          end
 
           processor = create_processor(settings, telemetry)
 
@@ -24,27 +42,11 @@ module Datadog
           devise_integration = Datadog::AppSec::Contrib::Devise::Integration.new
           settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
 
-          new(processor: processor)
+          new(processor, telemetry)
         end
 
         private
 
-        def incompatible_ffi_version?
-          ffi_version = Gem.loaded_specs['ffi'] && Gem.loaded_specs['ffi'].version
-          return true unless ffi_version
-
-          return false unless Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') &&
-            ffi_version < Gem::Version.new('1.16.0')
-
-          Datadog.logger.warn(
-            'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
-            'and will be forcibly disabled due to a memory leak in `ffi`. ' \
-            'Please upgrade your `ffi` version to 1.16.0 or higher.'
-          )
-
-          true
-        end
-
         def create_processor(settings, telemetry)
           rules = AppSec::Processor::RuleLoader.load_rules(
             telemetry: telemetry,
@@ -52,10 +54,6 @@ module Datadog
           )
           return nil unless rules
 
-          actions = rules['actions']
-
-          AppSec::Processor::Actions.merge(actions) if actions
-
           data = AppSec::Processor::RuleLoader.load_data(
             ip_denylist: settings.appsec.ip_denylist,
             user_id_denylist: settings.appsec.user_id_denylist,
@@ -63,9 +61,16 @@ module Datadog
 
           exclusions = AppSec::Processor::RuleLoader.load_exclusions(ip_passlist: settings.appsec.ip_passlist)
 
+          # NOTE: This is a temporary solution before the RuleMerger refactoring
+          #       with new RemoteConfig setup
+          processors = rules['processors']
+          scanners = rules['scanners']
+
           ruleset = AppSec::Processor::RuleMerger.merge(
             rules: [rules],
             data: data,
+            scanners: scanners,
+            processors: processors,
             exclusions: exclusions,
             telemetry: telemetry
           )
@@ -77,23 +82,26 @@ module Datadog
         end
       end
 
-      attr_reader :processor
+      attr_reader :processor, :telemetry
 
-      def initialize(processor:)
+      def initialize(processor, telemetry)
         @processor = processor
+        @telemetry = telemetry
+
         @mutex = Mutex.new
       end
 
-      def reconfigure(ruleset:, actions:, telemetry:)
+      def reconfigure(ruleset:, telemetry:)
         @mutex.synchronize do
-          AppSec::Processor::Actions.merge(actions)
+          new_processor = Processor.new(ruleset: ruleset, telemetry: telemetry)
+
+          if new_processor&.ready?
+            old_processor = @processor
 
-          new = Processor.new(ruleset: ruleset, telemetry: telemetry)
+            @telemetry = telemetry
+            @processor = new_processor
 
-          if new && new.ready?
-            old = @processor
-            @processor = new
-            old.finalize if old
+            old_processor&.finalize
           end
         end
       end
@@ -104,7 +112,7 @@ module Datadog
 
       def shutdown!
         @mutex.synchronize do
-          if processor && processor.ready?
+          if processor&.ready?
             processor.finalize
             @processor = nil
           end

data/lib/datadog/appsec/compressed_json.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'zlib'
+require 'stringio'
+
+require_relative '../core/utils/base64'
+
+module Datadog
+  module AppSec
+    # Converts derivative schema payloads into JSON and compresses them into a
+    # base64 encoded string if the payload is worth compressing.
+    #
+    # See: https://github.com/DataDog/dd-trace-rb/pull/3177#issuecomment-1747221082
+    module CompressedJson
+      MIN_SIZE_FOR_COMPRESSION = 260
+
+      def self.dump(payload)
+        value = JSON.dump(payload)
+        return value if value.bytesize < MIN_SIZE_FOR_COMPRESSION
+
+        compress_and_encode(value)
+      rescue ArgumentError, Encoding::UndefinedConversionError, JSON::JSONError => e
+        AppSec.telemetry.report(e, description: 'AppSec: Failed to convert value into JSON')
+
+        nil
+      end
+
+      private_class_method def self.compress_and_encode(payload)
+        Core::Utils::Base64.strict_encode64(
+          Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
+        )
+      rescue Zlib::Error, TypeError => e
+        AppSec.telemetry.report(e, description: 'AppSec: Failed to compress and encode value')
+
+        nil
+      end
+    end
+  end
+end